Control method for access gateway and communication system

ABSTRACT

In order to provide a redundancy configuration to an access gateway apparatus in which a control plane and a user plane are separated, the access gateway apparatus includes: a control computer for receiving control signals from the networks to establish the communication path, thereby determining packet transfer information for the data; and a transfer computer for receiving the packet transfer information from the control computer to transfer the data through the communication path. The transfer computer includes: a plurality of first transfer computers for executing the transfer of the data; and a second transfer computer for taking over, when a fault occurs in any one of the plurality of first transfer computers. The control computer includes: a first control computer for processing the control signals received from the networks; and a second control computer for taking over, when a fault occurs in the first control computer.

CLAIM OF PRIORITY

The present application claims priority from Japanese patent applicationJP2008-228938 filed on Sep. 5, 2008, the content of which is herebyincorporated by reference into this application.

BACKGROUND OF THE INVENTION

This invention relates to an access gateway apparatus for controllinguser access in a network system. More particularly, this inventionrelates to redundancy control and a session restoration method in anaccess gateway apparatus that includes a control access gatewayapparatus (C-AGW apparatus) for mainly processing a control signal and aplurality of user access gateway apparatuses (U-AGW apparatuses) formainly processing user packet transfer.

Popularization of broadband Internet services or third-generation mobilestations now enables a large number of users to use various services atany time of day. A carrier as a service provider has to build an accessnetwork system that may accommodate subscribers increasing in numberyear by year and deal with an increasing number of data access lineswithout any service stoppage. In a field of mobile wireless accesscommunication, an increase in number of sessions and improvement ofwireless communication band now require great improvement in throughputof the access gateway apparatus that accommodates wireless base stations(BSs). An exemplary access gateway apparatus is discussed in Sections4.4 and 4.6 of “Basic IP Service for Converged Access NetworkSpecification”, 3rd Generation Partnership Project 2, Dec. 19, 2007.

SUMMARY OF THE INVENTION

Under those circumstances, in a wireless access network such as an ultramobile broadband/converged access network (UMB/CAN) of 3rd GenerationPartnership Project 2 (3GPP2), which is a third generation mobilecommunication standardization organization, separation of a controlplane for processing a control message and a user plane for processinguser data from each other has been promoted, and Sections 6.3.5 of“Architecture Tents, Reference Model and Reference Points”, WiMAX FormNWG, Jul. 11 2008 disclose separation of a data (user data) path and asignaling (control signal) path from each other in the access gatewayapparatus (AGW).

Further, regarding an access service gateway (ASN-GW) that is an accessgateway of a worldwide interoperability for microwave access (WiMAX)system, Section 6.3.5 of “WiMAX Forum NWG_R1_V1.2-Stage-2-Part 1”discloses separation of a control plane from a user plane for processinguser data.

FIG. 28 illustrates a known example of a configuration of a networksystem using WiMAX. FIG. 28 is a block diagram illustrating aconventional example of the network system to which WiMAX is applied. Asillustrated in FIG. 28, the network system of WiMAX includes a mobilestation (MS) 8, a plurality of base stations (BSs) 7 a to 7 c thatcommunicate with the mobile station 8, a core network 1 equipped with anauthentication apparatus 2 and a home agent (HA) 3, and an accessgateway apparatus (AGW) 4 x for transferring a control signal and userdata between the base stations 7 a to 7 c and the core network 1.

The access gateway apparatus 4 x separately includes a control signalaccess gateway (C-AGW) 5 for processing the control signal (signaling)between the base stations 7 a to 7 c and the core network 1 and a userdata access gateway (U-AGW) 6 for transferring user data between thebase stations 7 a to 7 c and the home agent 3 of the core network 1.

An example of a connection sequence of the mobile station 8 in theconfiguration of FIG. 28 is as illustrated in FIG. 29. FIG. 29illustrates a conventional example of a connection sequence for WiMAX ofFIG. 28. The connection sequence of FIG. 29 is for WiMAX of FIG. 28, inwhich the ordinate indicates time, and the abscissa indicates eachapparatus. Hereinafter, the base stations 7 a to 7 c are genericallyreferred to as base stations 7.

In Step S1, the mobile station 8 performs initial ranging with the basestation 7. In Step S2, the mobile station 8 makes a request forcommunication speed (transmission capacity) or modulation method to theC-AGW 5 of the access gateway apparatus 4 x via the base station 7. TheC-AGW 5 executes basic capabilities negotiation to allocate acommunication speed to the mobile station 8 according to a communicationstate of the base station 7.

In Step S3, upon issuance of a connection request from the mobilestation 8, the base station 7 makes a connection request to the C-AGW 5of the access gateway apparatus 4 x based on predetermined IDs (mobilestation ID: MS ID and base station ID: BS ID). In Step S4, the C-AGW 5makes inquiries about the connection request from the mobile station 8to the authentication apparatus 2 to execute authentication. In Steps S5and S6, after completion of the authentication, the C-AGW 5 negotiateswith the home agent 3 and the base station 7 for a data path to an endpoint of the mobile station 8. For data path establishment with the basestation 7, the BS ID and a tunnel endpoint are designated to startnegotiation for the data path. The C-AGW 5 may designate an end gatewayapparatus of user data for the base station 7 by setting an address ofthe U-AGW 6 in the tunnel endpoint. The C-AGW 5 carries out proxy mobileIP (P-MIP) connection negotiation with the home agent 3 to determine atransfer path (MIP tunnel) of the user data. In this case, negotiationof a control signal of the P-MIP via the U-AGW 6 enables setting of anend gateway apparatus of the user data for the home agent 3 to the U-AGW6. In Step S7, the C-AGW 5 notifies the U-AGW 6 of the determinedtransfer path (data path). In Step S8, the U-AGW 6 executes transfer ofthe user data between the mobile station 8 and the base station 7 andthe home agent 3 through the data path notified by the C-AGW 5. Asillustrated in FIG. 29, the U-AGW 6 sets a generic routing encapsulation(GRE) tunnel with the base station 7, and a MIP tunnel with the homeagent 3 to execute user data transfer.

The WiMAX illustrated in FIGS. 28 and 29 is an example of separation, inthe access gateway apparatus 4 x, into the control plane for processingthe control signal and the user plane for processing the user data,i.e., separation into the C-AGW 5 and the U-AGW 6. When the controlplane and the user plane coexist in one access gateway apparatus 4 x asdescribed above, depending on throughput or a physical memory amount ofa processor of the access gateway apparatus 4 x, a packet transferspeed, session establishment time, or a maximum number of sessionsvaries. To solve this problem, separation of a control plane and a userplane is employed as illustrated in FIG. 28, enabling a apparatus(C-AGW) in charge of the control plane to perform more complex controland to deal with an increase in number of sessions. The user plane(U-AGW 6) may focus processing only on packet transfer, and thereforeallocate apparatus resources to user data transfer because of no complexcontrol signal, thereby increasing a transfer speed of the user data.

Further, for the future network system, there is a growing demand forlimiting, to a minimum, service stop time (down time) caused by a faultof the access gateway apparatus (especially VoIP service). To shortenthe service stop time, studies have been conducted on various redundancyconfigurations or session restoration control in the access gatewayapparatus. For example, as a redundancy configuration of the accessgateway apparatus illustrated in FIG. 28, an access gateway apparatusillustrated in FIGS. 30 to 32 may be employed.

For example, FIG. 30 is a block diagram when redundancy is achieved byN+1 access gateway apparatuses. In FIG. 30, a plurality of (N+1) accessgateway apparatuses 10, 14 and 20 may be installed, and the plurality ofaccess gateway apparatuses 10 and 14 may be operated as active systemswhile one access gateway apparatus 20 may be operated as a standbysystem. FIG. 30 illustrates, while only two access gateway apparatuses10 and 14 are illustrated, an example where N access gateway apparatusesare present. An IP address of a 1st access gateway apparatus 10 is #1,and an IP address of an N-th access gateway apparatus 14 is #N. Theactive access gateway apparatuses 10 and 14 include control signalprocessing units 11 and 15 for processing control signals, packettransfer processing units 13 and 17 for processing user data, and piecesof session information 12 and 16 for storing session information of amobile station and a home agent. The pieces of session information 12and 16 may be stored in memories of the control signal processing units11 and 15.

The standby access gateway apparatus 20 includes, as in the case of theactive system, a control signal processing unit 21 for processing acontrol signal, a packet transfer processing unit 27 for processing userdata, and N pieces of session information 22 to 26 for storing sessioninformation of a mobile station and a home agent. While FIG. 30illustrates the pieces of session information 22 to 26, N pieces ofsession information are actually present.

The N active access gateway apparatuses 10 and 14 transmit pieces ofsession information 12 and 16 thereof to the standby access gatewayapparatus 20 in a predetermined cycle. The standby access gatewayapparatus 20 stores the received pieces of session information 22 to 26.For the pieces of session information 22 to 26 stored by the standbyaccess gateway apparatus 20, it is only necessary to store pieces oflatest session information. The standby access gateway apparatus 20monitors faults of the N active access gateway apparatuses 10 and 14,and takes over the session information and the IP address received andstored from the faulty access gateway apparatus to become active upondetection of a fault.

In a configuration that includes N active systems and one standby systemas in the case illustrated in FIG. 30, N+1 access gateway apparatuseseach including a pair of a control plane and a user plane are disposed,and session control information of the N active access gatewayapparatuses is restored by one standby system. Hereinafter, redundancyby N+1 access gateway apparatuses is referred to as N+1 redundancy.

FIG. 31 is a block diagram illustrating a 1:1 access gateway apparatusconfiguration. The redundancy configuration of the access gatewayapparatuses of FIG. 31 includes one standby access gateway apparatus 35for one active access gateway apparatus 30. The active access gatewayapparatus 30 transmits session information 32 to the standby accessgateway apparatus 35 in the predetermined cycle, and the standby accessgateway apparatus 35 stores latest session information 37. The standbyaccess gateway apparatus 35 monitors a fault of the active accessgateway apparatus 30, and takes over the session information 37 and theIP address received and stored from the active access gateway apparatus30 to become active upon detection of a fault.

Hereinafter, a redundancy configuration where one active system isrestored by one standby system as in the case illustrated in FIG. 31 isreferred to as 1:1 (active/standby) redundancy configuration.

FIG. 32 is a block diagram illustrating a 1:1 access gateway apparatusredundancy configuration. In the redundancy configuration of the accessgateway apparatuses illustrated in FIG. 32, two active access gatewayapparatuses 40 and 45 monitor a fault of each other, and the otheractive system takes over when a fault occurs in one active system.

The access gateway apparatus 40 transmits session information 42 to theother active access gateway apparatus 45 in the predetermined cycle, andstores session information 43 received from the access gateway apparatus45 in the predetermined cycle. The access gateway apparatus 45transmits, as in the case of the access gateway apparatus 40, sessioninformation 48 to the other active access gateway apparatus 40 in thepredetermined cycle, and stores session information 47 received from theaccess gateway apparatus 40 in the predetermined cycle.

The two active access gateway apparatuses 40 and 45 monitor a fault ofeach other, and take over the session information and the IP address ofthe other active system stored in the own apparatus to continueprocessing based on two pieces of session information and two IPaddresses when detecting a fault.

Hereinafter, a redundancy configuration where two active systems monitora fault of each other to restore session control information as in thecase illustrated in FIG. 32 is referred to as 1:1 (active/active)redundancy configuration.

For the redundancy configuration of the access gateway apparatuses eachincluding a pair of a control plane and a user plane, as illustrated inFIGS. 30 to 32, the N+1 redundancy configuration, 1:1 (active/standby)redundancy configuration, or 1:1 (active/active) redundancyconfiguration may be employed.

Problems when redundancy is carried out by using such access gatewayapparatuses are as follows.

In the case of the N+1 redundancy configuration, the standby accessgateway apparatus 20 stores all pieces of session information 22 to 26of the active access gateway apparatuses 10 and 14 that monitor faults.Thus, a memory capacity has to be increased to store the pieces ofsession information 22 to 26, causing an increase in apparatus cost.Especially, when the number of sessions of the access gatewayapparatuses 10 and 14 is large, the memory capacity has to be increasedaccording to the number of sessions.

In addition, the standby access gateway apparatus 20 cannot transferuser data until session information stored at the time of a fault in theactive system is validated to notify the user plane of a transfer path,and setting of the transfer path is completed. Thus, time is necessaryfrom an occurrence of a fault in the active access gateway apparatus 20to permission of transfer by the standby system. When this time(downtime) is several seconds, in a case where the access gatewayapparatus 20 provides voice services such as a telephone (VoIP), a voiceis interrupted, causing degradation of service quality.

Further, because of the configuration where one standby system stores Npieces of active session information, traffic is enormous between theactive system and the standby system, and a communication band isnarrowed, reducing transfer performance of the user data. Especially, inthe case of a network system having a large number of sessions, theamount of session information is enormous. Thus, transfer of sessioninformation causes a reduction in transfer performance of the user data.

In the case of 1:1 (active/standby) redundancy configuration of theaccess gateway apparatuses each including a pair of a control plane anda user plane, facility costs of the standby system increase, causinghigher introduction expenses.

In the case of 1:1 (active/active) redundancy configuration of theaccess gateway apparatuses each including a pair of a control plane anda user plane, the other active system that takes over the faulty activesystem needs high throughput to execute the two active systems. As aresult, facility costs increase, causing higher introduction expenses.

Thus, the access gateway apparatuses each including a pair of a controlplane and a user plane have suffered from the difficulty of reducingdowntime when a fault occurs while suppressing an increase in apparatuscost. In addition, the access gateway apparatuses have suffered from thedifficulty of reducing downtime while suppressing apparatus costs, andreinforcing the user plane according to an increase of user data.

In view of the above-mentioned problems, this invention has been made,and therefore has an object to provide a redundancy configurationoptimal to an access gateway apparatus in which a control plane and auser plane are separated from each other, thereby reducing downtime whena fault occurs while suppressing apparatus costs, and reinforcing theuser plane according to an increase of user data.

To solve the problems, a communication system comprising: a routerconnected to a first network and a second network; and an access gatewayapparatus connected to the router, for transferring data by establishinga communication path between the first network and the second network,wherein: the access gateway apparatus comprises: a control computer forreceiving control signals from the first network and the second networkto establish a communication path, thereby determining packet transferinformation for the data; and a transfer computer for receiving thepacket transfer information from the control computer to transfer thedata between the first network and the second network through thecommunication path contained in the packet transfer information; thetransfer computer comprises: a plurality of first transfer computers forexecuting the transfer of the data; and a second transfer computer fortaking over, when a fault occurs in any one of the plurality of firsttransfer computers, processing of the faulty one of the plurality offirst transfer computers; the control computer comprises: a sessioninformation notification unit for notifying each of the plurality offirst transfer computers of information containing the determinedcommunication path as session information; a session information storageunit for storing the session information for each identifier of theplurality of first transfer computers; a first fault monitoring unit fordetecting an occurrence of a fault in any one of the plurality of firsttransfer computers; and a first switching control unit for obtaining,when the first fault monitoring unit detects the occurrence of the faultin any one of the plurality of the first transfer computers, anidentifier and an address of the faulty one of the plurality of firsttransfer computers, and the session information set in faulty one of theplurality of the first transfer computers from the session informationstorage unit, and notifying the second transfer computer of theidentifier, the address, and the session information that have beenobtained; the second transfer computer comprises a redundant controlunit for setting the identifier, the address, and the sessioninformation that have been received from the control computer in thesecond transfer computer to take over the transfer of the data; thecontrol computer comprises: a first control computer for receiving thecontrol signals from the first network and the second network toestablish the communication path, thereby determining the packettransfer information for the data; and a second control computer fortaking over, when a fault occurs in the first control computer,processing of the faulty first control computer; and the second controlcomputer comprises: a second fault monitoring unit for detecting anoccurrence of a fault in the first control computer; a sessioninformation copying unit for copying the session information from thefirst control computer in a predetermined cycle; and a second switchingcontrol unit for obtaining, when the second fault monitoring unitdetects the occurrence of the fault in the first control computer, anidentifier and an address of the faulty first control computer, settingthe identifier and the address that have been obtained in the secondcontrol computer, and taking over processing of the first controlcomputer based on the session information copied by the sessioninformation copying unit.

According to this invention, configuring a control computer forprocessing a control signal by 1:1 redundancy, configuring a transfercomputer for transferring data by N+1 (or N+M) redundancy, andtransmitting session information to the control computer or the transfercomputer when the standby system takes over the active transfer computerenable quick recovery from a fault. Configuring the control computer by1:1 redundancy, and configuring the transfer computer by N+1 (or N+M)redundancy enables limitation of the number of necessary computers to aminimum and reduction in introduction and maintenance costs of thecommunication system. When the number of sessions and the amount of dataincrease, active transfer computers may be added.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram illustrating an example of a wireless networksystem according to a first embodiment of this invention.

FIG. 2 is a block diagram illustrating a configuration of the C-AGWserving as the control plane according to the first embodiment of thisinvention.

FIG. 3 is a block diagram illustrating the configuration of the U-AGW.

FIG. 4 is a block diagram illustrating a relationship of functionelements between the C-AGW and the U-AGW illustrated in FIG. 2

FIG. 5A illustrates the session information 71 in detail.

FIG. 5B illustrates the session information 71 in detail.

FIG. 5C illustrates the session information 71 in detail.

FIG. 6 illustrates an example of packet transfer information stored inthe RAM of the U-AGW.

FIG. 7 is a sequence diagram illustrating an example of redundantcontrol when a fault occurs during an operation of the active C-AGW.

FIG. 8 is a flowchart illustrating, in detail, mirroring processing(transfer processing of the session information 71) carried out by thecontrol signal processing program 70 of the active C-AGW.

FIG. 9 is a flowchart illustrating, in detail, processing executed whenthe C-AGW monitor processing program 76 executed by the standby C-AGW 5b receives a message of a mirroring request from the active C-AGW 5 a.

FIG. 10 is a flowchart illustrating, in detail, WatchDog processing F3executed by the C-AGW monitor processing program 76 of the standby C-AGW5 b.

FIG. 11 is a flowchart illustrating, in detail, session restorationprocessing F4 executed by the C-AGW monitor processing program 76 of thestandby C-AGW.

FIG. 12 is a sequence diagram illustrating an example of redundantcontrol when a fault occurs during an operation of the active U-AGW 6 a.

FIG. 13 is a flowchart illustrating an example of redundant control ofthe U-AGW 6 executed by the U-AGW monitor processing program 75 of theactive C-AGW.

FIG. 14 is a flowchart illustrating an example of redundant control ofthe U-AGW 6 executed by the standby U-AGW.

FIG. 15 is a sequence diagram illustrating a second embodiment of thisinvention.

FIG. 16 is a flowchart illustrating an example of the above-mentionedfirst redundant control (F7) (illustrated in FIG. 15) of the U-AGWexecuted by the U-AGW monitor processing program 75 of the active C-AGW.

FIG. 17 is a flowchart illustrating an example of second redundantcontrol processing (session generation request processing: F8) of theU-AGW executed by the U-AGW monitor processing program 75 of the activeC-AGW 5 a.

FIG. 18 is a flowchart illustrating an example of processing executedwhen the redundant control program 67 of the standby U-AGW 6 c hasreceived a session create request from the active C-AGW 5 a.

FIG. 19 is a block diagram illustrating a relationship of functionelements between a control plane and a user plane according to a thirdembodiment.

FIG. 20 is a sequence diagram illustrating an example of redundantcontrol processing when a fault occurs during an operation of the activeU-AGW 6 a.

FIG. 21 is a flowchart illustrating an example of redundant controlprocessing (F10) of the U-AGW 6 executed by the U-AGW monitor processingprogram 75 of the active C-AGW 5 a illustrated in FIG. 20.

FIG. 22 is a block diagram illustrating a relationship of functionelements between the C-AGW 5 and the U-AGW 6.

FIG. 23 is a sequence diagram illustrating an example of redundantcontrol processing when a fault occurs during an operation of the activeU-AGW 6 a.

FIG. 24 is a flowchart illustrating an example of mirroring processing(F11) of the packet transfer information 66 carried out by the packettransfer program 65 of the active U-AGW 6 a illustrated in FIG. 23.

FIG. 25 is a flowchart illustrating an example of processing where thestandby U-AGW 6 c updates active session information 711 in the piecesof packet transfer information 66-1 to 66-N for each active U-AGW 6(F12).

FIG. 26 is a flowchart illustrating an example of the first redundantcontrol of the U-AGW 6 executed by the U-AGW monitor processing program75 of the active C-AGW 5 a illustrated in FIG. 23.

FIG. 27 is a flowchart illustrating an example of the first redundantcontrol (F14) of the U-AGW 6 executed by the redundant control program67 of the standby U-AGW 6 c illustrated in FIG. 23.

FIG. 28 illustrates a known example of a configuration of a networksystem using WiMAX.

FIG. 29 illustrates a conventional example of a connection sequence forWiMAX of FIG. 28.

FIG. 30 is a block diagram when redundancy is achieved by N+1 accessgateway apparatuses.

FIG. 31 is a block diagram illustrating a 1:1 access gateway apparatusconfiguration.

FIG. 32 is a block diagram illustrating a 1:1 access gateway apparatusredundancy configuration.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

Hereinafter, referring to the accompanying drawings, the preferredembodiments of this invention are described.

First Embodiment

FIG. 1 is a block diagram illustrating an example of a wireless networksystem according to a first embodiment of this invention. For a wirelessnetwork of this embodiment, for example, the WiMAX described as theconventional example is employed.

In FIG. 1, the wireless network system includes a mobile station (MS) 8,a plurality of base stations (BSs) 7 a to 7 c that communicate with themobile station 8, a core network 1 that includes an authenticationapparatus 2 and a home agent (HA) 3 to communicate with an accessgateway apparatus (AGW) 4, and a router 400 that interconnects the basestations 7 a to 7 c, the core network 1, and the access gatewayapparatus 4. The access gateway apparatus 4 transfers a control signaland user data (data packet) between the base stations 7 a to 7 c and thecore network 1.

The access gateway apparatus 4 separately includes a plurality ofcontrol signal access gateways (C-AGWs or control planes) 5 a and 5 bfor processing a control signal (signaling) between the base stations 7a to 7 c and the core network 1, and a plurality of user data accessgateways (U-AGWs or user planes) 6 a to 6 c for transferring user databetween the base stations 7 a to 7 c and the home agent 3 of the corenetwork 1. The C-AGWs 5 a and 5 b and the U-AGWs 6 a to 6 c areconnected to a switch 9. The switch 9 is connected to the core network 1via the router 400 to transfer a control signal and user data betweenthe access gateway apparatus 4 and the core network 1. If the mobilestation 8 and the base station 7 comprise a first network, and the corenetwork is a second network, the access gateway apparatus 4 adjusts acommunication status and determines a communication path between thefirst and second networks by the C-AGWs 5 based on the control signal,and transfers user data through the determined communication path by theU-AGWs 6.

The C-AGWs that process a control signal and monitor the active c-AGWand the U-AGWs include an active C-AGW 5 a for processing the controlsignal during normal time and a standby C-AGW 5 b for taking overprocessing of the faulty C-AGW 5 a. Hereinafter, the active C-AGW 5 aand the standby C-AGW 5 b are generically referred to as C-AGWs 5(control planes).

The U-AGWs that processes user data include active U-AGWs 6 a and 6 bfor processing the control signal during normal time and a standby U-AGW6 c for taking over processing of the user data when a fault occurs inone of the active U-AGWs 6 a and 6 b. Hereinafter, the active U-AGWs 6 aand 6 b and the standby U-AGW 6 c are generically referred to as U-AGWs6 (user planes). The base stations 7 a to 7 c are generically referredto as base station 7.

In the access gateway apparatus 4 of this invention, the C-AGW 5 thatprocesses the control signal is subjected to 1:1 redundancy processingby the active C-AGW 5 a and the standby C-AGW 5 b, and the active C-AGW5 a manages pieces of session information of the active U-AGWs 6 a and 6b. The U-AGW 6 that transfers the user data is subjected to N+1redundancy processing by N active U-AGWs and one standby U-AGW 6 c. Forsession allocation to the active U-AGW 6, a control signal processingprogram 70 of the active C-AGW 5 a determines sessions to be allocatedto the active U-AGWs 6 a and 6 b according to the number of sessions,and notifies the active U-AGWs 6 a and 6 b of the sessions. For example,the active C-AGW 5 a may allocate sessions such that the numbers ofsessions transferred by the active U-AGWs 6 a and 6 b are almost equal.Alternatively, the active C-AGW 5 a may allocate sessions so as toprevent the amounts of data transferred by the active U-AGWs 6 a and 6 bfrom exceeding a predetermined threshold value.

Configuration of C-AGW

Next, a configuration of the C-AGW 5 is described. FIG. 2 is a blockdiagram illustrating a configuration of the C-AGW 5 serving as thecontrol plane according to the first embodiment of this invention. Theactive C-AGW 5 a and the standby C-AGW 5 b are similar in configurationbut different in programs to be operated during normal time.

In FIG. 2, the C-AGW 5 includes a CPU (processor) 51 for performing anarithmetic operation, a ROM (nonvolatile memory) 50 for storingprograms, a RAM (volatile memory) 52 for temporarily storing programsloaded from the ROM 50 or data used by the CPU 51, a communication (IP)interface 53 connected to the switch 9 to control communication, a userinterface 54 for receiving setting information from a management console(not shown), and a computer (control computer) including an internalnetwork (or internal bus) 53 for interconnecting the components.

The ROM 50 stores a control signal processing program 70 for processinga control signal from the mobile station 8, the base station 7 or thecore network 1 to determine a transfer path of user data, a C-AGWmonitor processing program 76 for monitoring the active C-AGW 5 a, and aU-AGW monitor processing program 75 for monitoring the active U-AGW 6.

The RAM 52 stores loaded programs to be executed by the CPU 51, andsession information 71 for each of the active U-AGWs 6 a and 6 b.Generally, in the wireless network, to effectively utilize a wirelessband, session information managed by the access gateway with respect toa connected status of the terminal is largely classified into two.Session information indicating a communicable status or an ongoingcommunication status of a mobile station is defined as active sessioninformation, and the access gateway establishes transfer paths (datapaths) with the base station and the HA in this case. Sessioninformation indicating a power-saving status or a long-time nocommunication status of the mobile station is defined as idle sessioninformation. The access gateway establishes a transfer path only withthe HA in this case. When a user packet addressed to the mobile stationis received from the HA in the idle status, the access gateway changesthe mobile station to an active status by using a paging function uniqueto the wireless network to establish a transfer path again with the basestation.

In the C-AGW 5, pieces of session information 71 of the U-AGWs aresorted to be stored according to the communication statuses of themobile station. For example, session information indicating execution ofcommunication is stored as active session information 711, sessioninformation indicating suspended communication (or power-saving mode ofthe mobile station 8) is stored as idle session information 712, wherebypieces of session information are sorted according to communicationstatuses.

The active C-AGW 5 a loads the control signal processing program 70 andthe U-AGW monitor processing program 75 into the RAM 52 to execute themby the CPU 51. The standby C-AGW 5 b loads the C-AGW monitor processingprogram 76 into the RAM 52 to execute it by the CPU 51. When the C-AGWmonitor processing program 76 of the standby C-AGW 5 b detects a faultof the active C-AGW 5 a, as described below, the control signalprocessing program 70 and the U-AGW monitor processing program 75 areactivated to take over processing of the active system based on thesession information 71 obtained from the active C-AGW 5 a. Aconventional well-known method may be used for fault detection. Forexample, the monitor processing program 76 of the standby C-AGW 5 btransmits a WatchDog request to the active C-AGW 5 a to monitor aWatchDog response from the active C-AGW 5 a in a predeterminedmonitoring cycle, and determines a fault occurrence of the active C-AGW5 a when no WatchDog response comes even after a predetermined faultdetermination time has elapsed. The C-AGW monitor processing program 76of the standby C-AGW 5 b takes over processing from the active C-AGW 5a.

Processing contents of the control signal processing program 70 aresimilar to those of FIG. 29 described above in the background art.Authentication is carried out at the authentication apparatus 2according to a connection request from the mobile terminal 8, andconnection negotiation of a proxy mobile IP (P-MIP) is carried out withthe home agent 3 to determine a transfer path (MIP tunnel) of the userdata. Data path setting negotiation is carried out with the base station7 to determine a transfer path (GRE tunnel) of the user data. Then, thecontrol signal processing program 70 notifies the U-AGW 6 of thedetermined transfer path (data path). The control signal processingprogram 70 stores the session information 71 containing information ofthe data paths set with the base station 7 and the home agent 3 in theRAM 52. The control signal processing program 70 transmits sessioninformation 71 of each U-AGW to the standby C-AGW 5 b to store a copy ofthe session information 71 in the standby C-AGW 5 b. This processing maybe carried out by the control signal processing program 70 of the activeC-AGW 5 a and the C-AGW monitor processing program 76 of the standbyC-AGW 5 b. The control signal processing program 70 of the active C-AGW5 a transmits session information 71 in a predetermined update cycle.The C-AGW monitor processing program 76 of the standby C-AGW 5 breceives the session information 71 to store its copy in the RAM 52.

The active U-AGWs 6 a and 6 b transfer user data with the mobile station8, the base station 7 and the home agent 3 based on packet transferinformation (data path) received from the active C-AGW 5 a.

The U-AGW monitor processing program 75 executed by the active C-AGW 5 amonitors the active U-AGWs 6 a and 6 b, and instructs, when detecting afault, the standby U-AGW 6 c to take over processing of the faultyactive U-AGWs 6 a and 6 b. The U-AGW monitor processing program 75detects a fault of the active U-AGW 6 based on presence/absence of aWatchDog response to a WatchDog request as in the case of the C-AGWmonitor processing program 76.

Configuration of U-AGW

Next, a configuration of the U-AGW 6 for transferring user data isdescribed. FIG. 3 is a block diagram illustrating the configuration ofthe U-AGW 6. The active U-AGWs 6 a and 6 b and the standby U-AGW 6 c aresimilar in configuration but different in programs to be operated duringnormal time.

In FIG. 3, the U-AGW 6 includes a processor (CPU) 61 for performing anarithmetic operation, a nonvolatile memory (ROM) 60 for storingprograms, a volatile memory (RAM) 62 for temporarily storing programsloaded from the ROM 60 or data used by the CPU 61, a communication (IP)interface 63 connected to the switch 9 to control communication, and acomputer (packet transfer computer) including an internal network (orinternal bus) 63 for interconnecting the above-mentioned components.

The ROM 60 stores a packet transfer program 65 for transferring userdata from the mobile station 8, the base station 7 or the core network 1through a designated transfer path, and a redundant control program 67for receiving a redundant command from the active C-AGW 5 a to activatethe packet transfer program 65.

The RAM 62 stores programs loaded to be executed by the CPU 61, and atransfer path (session information) of user data received from theactive C-AGW 5 a as packet transfer information 66. In the packettransfer information 66, session information indicating ongoingcommunication is stored as active session information 661, and sessioninformation indicating suspended communication is stored as idle sessioninformation 662.

The packet transfer program 65 transfers user data (packet) with themobile station 8 and the home agent 3 through a transfer path designatedby the packet transfer information 66 received from the active C-AGW 5a.

The redundant control program 67 receives an identifier, an IP addressand session information 71 (including active session information 711 andidle session information 712) of a user plane, from which transferprocessing of the user data is to be taken over, from the active C-AGW 5a, and sets the identifier and the IP address of the user plane, fromwhich the processing is to be taken over in the standby U-AGW 6 c. Theredundant control program 67 sets packet transfer information 66 fromthe session information 71 to activate the packet transfer program 65.The packet transfer program 65 executes transfer of user data accordingto the packet transfer information 66.

As illustrated in FIG. 29, the active U-AGW 6 sets a generic routingencapsulation (GRE) tunnel between the base station 7 and the accessgateway apparatus 4, and the U-AGWs 6 a and 6 b set a MIP tunnel betweenthe home agent 3 and the access gateway apparatus 4 to execute transferof user data.

When a fault occurs in any one of the active U-AGWs 6 a and 6 b, thestandby U-AGW 6 c receives packet transfer information 66 and an IPaddress of an active U-AGW, from which the processing is to be takenover, from the active C-AGW 5 a, and takes over the processing of thefaulty active U-AGW.

Processing Flow in Access Gateway Apparatus

FIG. 4 is a block diagram illustrating a relationship of functionelements between the C-AGW 5 and the U-AGW 6 illustrated in FIGS. 2 and3. FIG. 4 illustrates a status where the C-AGW 5 and the U-AGW 6normally operate.

The active C-AGW 5 a executes the control signal processing program 70and the U-AGW monitor processing program 75, while the standby C-AGW 5 bexecutes the C-AGW monitor processing program 76. An IP address A is setin the active C-AGW 5 a, and a control signal is processed with the basestation 7 or the home agent 3 via the router 400.

In the U-AGW 6, N U-AGWs 6 (U-AGW 6 a is a first active apparatus, andU-AGW 6 b is an N-th active apparatus) operate as active U-AGWs for theactive system, and one standby U-AGW 6 c stands by. An IP address B isset in the active U-AGW 6 a, and an IP address C is set in the activeU-AGW 6 b. In the active U-AGWs 6 a and 6 b, packet transfer programs 65operate, and under data is transferred with the base station 7 and thehome agent 3 via the router 400.

The control signal processing program 70 of the active C-AGW 5 aprocesses the control signal as described above to notify each of theactive U-AGWs 6 of packet transfer information 66, and sorts pieces ofsession information 71-1 to 71-N of the active U-AGW 6 into pieces ofactive session information 711-1 to 711-N and pieces of idle sessioninformation 712-1 to 712-N to store them in the RAM 52. The controlsignal processing program 70 transmits the pieces of session information71-1 to 71-N of the U-AGW 6 stored in the RAM 52 to the standby C-AGW 5b in the predetermined update cycle. The standby C-AGW 5 b stores copiesof the pieces of session information 71 a-1 to 71 a-N in the RAM 52. Thestandby C-AGW 5 b stores, in the RAM 52, pieces of active sessioninformation 711 a-1 to 711 a-N and pieces of idle session information712 a-1 to 712-N as copied pieces of session information 71 a-1 to 71a-N. A generic name of active session information 711-1 to 711-N isactive session information 711, and a generic name of idle sessioninformation 712-1 to 712-N is idle session information 712.

With this configuration, the standby C-AGW 5 b stores copies 71 a-1 to71 a-N of the pieces of session information 71-1 to 71-N of N userplanes. The active C-AGW 5 a transmits session information 71 to thestandby C-AGW 5 b in the predetermined update cycle to update the copies71 a-1 to 71 a-N of the session information to the latest information.Thus, performing 1:1 redundancy processing in the control plane andmirroring the session information enable efficient utilization ofresources of the control plane. Mirroring the session informationenables the standby C-AGW 5 b to take over processing based on thecopied session information 71 a within a short time period from a faultoccurrence of the active C-AGW 5 a and to be used for a network forvoice services.

In the control plane, no user data transfer is carried out. Thus, evenwhen the number of sessions increases, the control signal may beprocessed without any influence on throughput of packet transfer.

In the user plane, N+1 redundancy processing is carried out to copypacket transfer information in the control plane, and hence the userdate may be efficiently transferred.

FIGS. 5A to 5C illustrate the session information 71 in detail. FIG. 5Aillustrates an example of the session information 71. FIG. 5Billustrates an example of the active session information 711constituting the session information 71. FIG. 5C illustrates an exampleof the idle session information 712 constituting the session information71.

As illustrated in FIG. 5A, the session information 71 includes maininformation for each U-AGW 6 (control information regarding connection),a pointer indicating active session information 711 for each U-AGW 6,and a pointer indicating idle session information 712 for each U-AGW 6.Each pointer stores an address in the RAM 52 of the C-AGW 5 a.

In FIG. 5A, an entry of the session information 71 includes a U-AGW ID101 for storing an identifier of the U-AGW 6 managed by the C-AGW 5 a, aU-AGW status 102 for storing which of active and standby the U-AGW 6designated by the identifier is, a U-AGW IP address 103 for storing anIP address set in the U-AGW 6, the number of active sessions 104 forstoring the number of sessions being communicated among the numbers ofsessions processed by the U-AGW 6, the number of idle sessions 105 forstoring the number of stopped sessions among the numbers of sessionsprocessed by the U-AGW 6, a pointer 106 indicating a storage destinationof active session information 711 of each U-AGW 6, and a pointer 107indicating a storage destination of idle session information 712 of eachU-AGW 6.

FIG. 5B illustrates an example of the active session information 711designated by the pointer 106 of the session information 71. An entry ofthe active session information 711 includes an MS ID 110 for storing anidentifier of the mobile station 8 that transfers user data, an MS IPaddress 111 for storing an IP address of the mobile station 8, a GREtunnel information pointer 112 for storing a pointer indicating GREtunnel information, an MIP tunnel information pointer 113 for storing apointer indicating MIP tunnel information, an accounting informationpointer 114 for storing accounting information for the mobile station 8,an MS status 115 for storing “Active” indicating a communication statusof the mobile station 8, a pointer 116 indicating authenticationinformation of the mobile station 8, and a session lifetime 117.

In the active session information 711, information of the MS ID 110 toMS status 115 constitutes packet transfer information 66 which the U-AGW6 is notified of.

FIG. 5C illustrates an example of the idle session information 712designated by the pointer (idle session information pointer) 107 of thesession information 71. The idle session information 712 is differentfrom the active session information 711 in that the MS status 115 is“Idle” but similar thereto in other elements.

FIG. 6 illustrates an example of packet transfer information 66 storedin the RAM 62 of the U-AGW 6. An entry of the packet transferinformation 66 includes an MS ID 120 for storing an identifier of themobile station 8 to which user data is transferred, an MS IP address 121for storing an IP address of the mobile station 8, a GRE tunnelinformation pointer 122 for storing a pointer indicating GRE tunnelinformation, an MIP tunnel information pointer 123 for storing a pointerindicating MIP tunnel information, an accounting information pointer 124for storing accounting information of the mobile station 8, and an MSstatus 125 for storing a communication status of the mobile terminal 8.

The packet transfer information 66 is configured to store the packettransfer information of the active session information 711 and the idlesession information 712 of FIGS. 5B and 5C. The packet transferinformation 66 is stored by each U-AGW 6, and includes informationregarding a communication destination (MS ID 120) and a path specifiedfrom the active C-AGW 5 a.

Failover of Control Plane

FIG. 7 is a sequence diagram illustrating an example of redundantcontrol when a fault occurs during an operation of the active C-AGW 5 a.In FIG. 7, the ordinate indicates time, and the abscissa indicates theapparatuses including the base station 7 or the home agent 3, the router400, the active C-AGW 5 a, the standby C-AGW 5 b, and the active U-AGW6.

First, in Step S9, the active C-AGW 5 a issues a mirroring request forcopying session information 71 to the standby C-AGW 5 b for each passageof a predetermined update cycle (cycle of mirroring timer) by mirroringprocessing (F1) of the control signal processing program 70. The standbyC-AGW 5 b stores a copy of the received session information 71 in theRAM 52.

In Step S10, the active U-AGW 6 transfers user data (user packet)between the base station 7 and the home agent 3 via the router 400. InStep S11, the active C-AGW 5 a processes a control signal from the basestation 7 or the home agent 3 via the router 400 as described above.

In Step S12, the standby C-AGW 5 b carries out WatchDog processing (F3)by the C-AGW monitor processing program 76 to transmit a Watchdogrequest to the active C-AGW 5 a in the predetermined monitoring cycle(cycle of WatchDog timer). In Step S13, the active C-AGW 5 a that hasreceived the WatchDog request returns a predetermined message as aWatchDog response. If the active C-AGW 5 a normally operates, eachprocessing is repeated by the above flow.

In Step S14, if a fault occurs in the active C-AGW 5 a, the active C-AGW5 a returns no WatchDog response even with a passage of predeterminedfault determination time (within cycle of response timer) aftertransmission of a WatchDog request from the standby C-AGW 5 b. In steps15 a and S15 b, the standby C-AGW 5 b transmits WatchDog requests apredetermined number of times in each fault determination time. If noWatchDog response may be received from the active C-AGW 5 a even whenWatchDog requests are transmitted a predetermined number of times, thestandby C-AGW 5 b determines a fault occurrence in the active C-AGW 5 ato activate redundant control (F4).

In Step S16, the standby C-AGW 5 b takes over an IP address (=A) set inthe active C-AGW 5 a, and then transmits a gratuitous ARP to the router400. Thus, the router 400 may change a transfer destination of the IPaddress (=A) to the standby C-AGW 5 b. Then, the standby C-AGW 5 bactivates the control signal processing program 70 and the U-AGW monitorprocessing program 75 to activate processing of a control signal andmonitoring of the U-AGW 6.

Having taken over the control signal processing, the standby C-AGW 5 bprocesses the control signal received from the base station 7 or thehome agent 3 via the router 400. Transfer of the user data is carriedout at the base station 7 or the home agent 3, the router 400 and theactive U-AGW 6 as in the case before the occurrence of a fault in theactive C-AGW 5-a.

This way, the session restoration processing that takes over processingof the control signal by the standby C-AGW 5 b when a fault occurs inthe active C-AGW 5 a is completed.

Each of the processes F1 to F4 illustrated in FIG. 7 is described belowin detail.

FIG. 8 is a flowchart illustrating, in detail, mirroring processing(transfer processing of the session information 71) carried out by thecontrol signal processing program 70 of the active C-AGW 5 a.

First, in Step S200, whether the mirroring timer has reached thepredetermined update cycle is judged. If the mirroring timer has notreached the predetermined update cycle, the processing proceeds to StepS201.

In Step S201, a transmission buffer is set in the RAM 52 for the activeC-AGW 5 a to transmit a message of a mirroring request for copyingsession information 71 to the standby C-AGW 5 b.

In Step S202, the active C-AGW 5 a obtains contents of the sessioninformation 71, and repeats Steps S203 to S206 to create a message. InStep S203, the active C-AGW 5 a repeats Steps S204 to S206 until thereis no more entry of a transmission target having an identifier of theU-AGW 6 stored in U-AGW_ID 101 of the session information 71 illustratedin FIG. 5A. If there is still an entry of a transmission target in thesession information 71, the active C-AGW 5 a proceeds to Step S204 tocreate a message. If there is no entry of a transmission target left inthe U-AGW_ID 101 of the session information 71, the active C-AGW 5 aproceeds to Step S207.

In Step S204, the active C-AGW 5 a copies the values of the U-AGW_ID 101to the number of idle sessions 105 in the session information 71illustrated in FIG. 5A to the transmission buffer. In Step S205, theactive C-AGW 5 a copies active session information 711 specified by theactive session information pointer 106 of the session information 71 tothe transmission buffer. In Step S206, the active C-AGW 5 a copies idlesession information 712 specified by the idle session informationpointer 107 of the session information 71 to the transmission buffer.

After completion of message creation for all the entries of the sessioninformation 71, in Step S207, the active C-AGW 5 a transmits contents ofthe transmission buffer to the standby C-AGW 5 b. The active C-AGW 5 aresets the mirroring timer to prepare for next transmission.

Thus, the active C-AGW 5 a transmits the session information 71 to thestandby C-AGW 5 b in each predetermined update cycle.

FIG. 9 is a flowchart illustrating, in detail, processing executed whenthe C-AGW monitor processing program 76 executed by the standby C-AGW 5b receives a message of a mirroring request from the active C-AGW 5 a.

Upon reception of a message of the session information 71 from theactive C-AGW 5 a, the standby C-AGW 5 b updates pieces of sessioninformation 71 a-1 to 71 a-N illustrated in FIG. 4 to be stored in theRAM 52. First, in Step S210, whether setting of all the U-AGW_IDs of thereceived messages in the RAM 52 has been completed is judged. If notcompleted, the standby C-AGW 5 a proceeds to Step S211 to set nextU-AGW_IDs in the pieces of session information 71 a-1 to 71 a-N of theRAM 52. On the other hand, if setting of all the U-AGW_IDs of thereceived messages in the RAM 52 has been completed, the processing isfinished.

In Step S211, the standby C-AGW 5 b reads the values of the U-AGW_ID 101to the number of sessions 105 of the session information 71 illustratedin FIG. 5A from the received message to update the values of the piecesof session information 71 a-1 to 71 a-N of the RAM 52.

In Step S212, the standby C-AGW 5 b reads the active session information71 illustrated in FIG. 5B from the received message to update pieces ofactive session information 711 a-1 to 711 a-N. In Step S213, the standbyC-AGW 5 b sets addresses in the RAM 52 of the pieces of active sessioninformation 711 a-1 to 711 a-N in the active session informationpointers 106 of the pieces of session information 71 a-1 to 71 a-N.

In Step S214, the standby C-AGW 5 b reads the idle session information712 illustrated in FIG. 5C from the received message to update thepieces of idle session information 712 a-1 to 712 a-N. Then, in StepS215, the standby C-AGW 5 b sets addresses in the RAM 51 of the piecesof idle session information 712 a-1 to 712 a-N in the idle sessioninformation pointers 107 of the pieces of session information 71 a-1 to71 a-N.

Thus, the standby C-AGW 5 b updates the pieces of session information 71a-1 to 71 a-N of the RAM 52 from the message sent from the active C-AGW5 a, and stores copies of the pieces of session information 71-1 to 71-Nof the active C-AGW 5 a.

FIG. 10 is a flowchart illustrating, in detail, WatchDog processing F3executed by the C-AGW monitor processing program 76 of the standby C-AGW5 b.

In Step S220, whether a WatchDog timer has counted up to a predeterminedmonitoring cycle is judged. If the predetermined monitoring cycle haspassed, the processing proceeds to Step S221.

In Step S221, the standby C-AGW 5 b transmits a WatchDog request to theactive C-AGW 5 a. In Step S222, the standby C-AGW 5 b activatesprocessing of waiting for a WatchDog response from the active C-AGW 5 a.

In Step S223, the standby C-AGW 5 b judges whether a WatchDog responsehas been received from the active C-AGW 5 a. If not received, theprocessing proceeds to Step S224. If received, the processing proceedsto Step S227.

In Step S227, because a WatchDog response has been received, it isjudged that the active C-AGW 5 a normally operates, and the standbyC-AGW 5 b resets the WatchDog timer to resume counting of thepredetermined monitoring cycle.

On the other hand, in Step S224, whether a value of a response timer forcounting time after the setting of WatchDog response waiting has reachedthe predetermined fault judgment time is judged. If the value of theresponse timer has not reached the predetermined fault judgment time,the processing returns to Step S223 to wait for a WatchDog response. Ifthe value of the response timer has passed the predetermined fault time,the processing proceeds to Step S225.

In Step S225, the standby C-AGW 5 b adds 1 to the number of retriesindicating the number of retransmitting WatchDog requests withoutreceiving any WatchDog response. Then, the standby C-AGW 5 b judgeswhether the number of retries has reached a predetermined number oftimes. If the number of retries has not reached the predetermined numberof times, returning to Step S221, the standby C-AGW 5 b retransmits aWatchDog request. On the other hand, if the number of retries hasreached the predetermined number of times, proceeding to Step S226, thestandby C-AGW 5 b judges that a fault has occurred in the active C-AGW 5a to be monitored. The standby C-AGW 5 b executes session restorationprocessing to take over processing from the active C-AGW 5 a.

Thus, the standby C-AGW 5 b transmits WatchDog requests in thepredetermined monitoring cycle, retransmits a WatchDog request at eachpredetermined fault judgment cycle, and may detect the occurrence of afault in the active C-AGW 5 a when the number of retransmitting timeshas reached a predetermined number of times.

FIG. 11 is a flowchart illustrating, in detail, session restorationprocessing F4 executed by the C-AGW monitor processing program 76 of thestandby C-AGW 5 b.

Upon detection of a fault occurrence in the active C-AGW 5 a, in StepS230, the C-AGW monitor processing program 76 of the standby C-AGW 5 btakes over an IP address of the active C-AGW 5 a. Then, in Step S231,the standby C-AGW 5 b activates the control signal processing program70.

In Step S232, the standby C-AGW 5 b transmits a gratuitous ARP to therouter 400 to change a transfer destination of the taken-over IP address(=A) to the standby C-GW 5 b. The standby C-AGW 5 b activates thecontrol signal processing program 70 and the U-AGW monitor processingprogram 75 to execute processing of a control signal and monitoring ofthe U-AGW 6.

Failover of User Plane

FIG. 12 is a sequence diagram illustrating an example of redundantcontrol when a fault occurs during an operation of the active U-AGW 6 a.In FIG. 12, the ordinate indicates time, and the abscissa indicates theapparatuses including the base station 7 or the home agent 3, the router400, the active C-AGW 5 a, the active U-AGW 6 a, and the standby U-AGW 6c. Though not shown, processing below is executed between the activeC-AGW 5 a and the active U-AGW 6 b.

In Step S20, the active U-AGW 6 a transfers user data (user packet)between the base station 7 and the home agent 3 via the router 400. InStep S21, the active C-AGW 5 a processes a control signal from the basestation 7 or the home agent 3 via the router 400 as described above.

The active C-AGW 5 a carries out WatchDog processing (F3) by the U-AGWmonitor processing program 75 to transmit a WatchDog request to theactive U-AGW 6 a at each predetermined monitoring cycle (cycle ofWatchDog timer). The WatchDog processing executed by the U-AGW monitorprocessing program 75 for the active U-AGW 6 is similar to that of theC-AGW monitor processing program 76 illustrated in FIGS. 7 and 10. Theactive C-AGW 5 a transmits WatchDog requests to the active U-AGWs 6 aand 6 b in the predetermined monitoring cycle. If no WatchDog responsemay be received from the active U-AGW 6 a or 6 b, the active C-AGW 5 aretransmits a WatchDog request in each fault judgment cycle, and detectsa fault occurrence in the active U-AGW 6 a or 6 b when the number ofretransmitting times reaches a predetermined number of times. WatchDogprocessing of the U-AGW monitor processing program 75 is similar to thatof the C-AGW monitor processing program 76, and thus repeateddescription is omitted.

In Step S23, the active C-AGW 5 a detects an occurrence of a fault inthe U-AGW 6 a as a result of the WatchDog processing for the activeU-AGW 6 a.

The active C-AGW 5 a activates redundant control of the U-AGW 6 (F5). Inthis redundant control, the active C-AGW 5 a obtains an identifier andan IP address of the faulty active U-AGW 6 a, and selects all pieces ofsession information 71 (active session information 711 and idle sessioninformation 712) for the identifier. In Step S24, the active C-AGW 5 atransmits an activate request containing the obtained identifier and IPaddress of the U-AGW 6 a and all the selected pieces of sessioninformation 71 to the standby U-AGW 6 c.

The standby U-AGW 6 c that has received the activate request activatesredundant control of the faulty active U-AGW 6 by the redundant controlprogram 67 (F6). The standby U-AGW 6 c obtains the identifier and the IPaddress contained in the activate request to set them therein. Thestandby U-AGW 6 c obtains the session information 71 contained in theactivate request to set the session information 71 in the packettransfer information 66.

In Step S25, the redundant control program 67 of the standby U-AGW 6 creturns an active response to the activate request received from theactive C-AGW 5 a to the active C-AGW 5 a. In Step S26, the standby U-AGW6 c sets the IP address (IP address of the faulty active U-AGW 6 a)contained in the activate request therein, and then transmits agratuitous ARP to the router 400 to change a transfer destination of thetaken-over IP address (=B) to the standby U-AGW 6 c.

In Step S27, the redundant control program 67 of the standby U-AGW 6 cactivates the packet transfer program 65 to activate transfer processingof user data.

Thus, the active C-AGW 5 a monitors the active U-AGW 6. When detecting afault in one of active U-AGWs 6, the active C-AGW 5 a transmits anactivate request containing an identifier, an IP address, and sessioninformation 71 of the faulty U-AGW 6 to the standby U-AGW 6 c, therebycausing the standby U-AGW 6 c to take over packet transfer processing.

Next, redundant control of the U-AGW 6 by the active C-AGW 5 a executedin F5 of FIG. 12 is described.

FIG. 13 is a flowchart illustrating an example of redundant control ofthe U-AGW 6 executed by the U-AGW monitor processing program 75 of theactive C-AGW 5 a. This processing is carried out when the U-AGW monitorprocessing program 75 detects a fault of the active U-AGW 6 in WatchDogprocessing.

In Step S235, the active C-AGW 5 a sets a transmission buffer in the RAM52 so as to transmit a message of an activate request for activating thestandby U-AGW 6 c.

In Step S236, the active C-AGW 5 a obtains an identifier and an IPaddress of the faulty active U-AGW 6, and session information 71corresponding to the identifier.

In Step S237, the identifier and the IP address of the faulty U-AGW 6are set in the transmission buffer.

In Step S238, the active C-AGW 5 a obtains session information 71 andactive session information 711 specified by an active sessioninformation pointer 106 of the session information 71. In Step S239, theactive C-AGW 5 a copies packet transfer information of the sessioninformation 71 and the active session information 711 to thetransmission buffer.

In Step S240, the active C-AGW 5 a obtains idle session information 712specified by an idle session information pointer 107 of the sessioninformation 71. In Step S241, the active C-AGW 5 a copies packettransfer information of the idle session information 712 to thetransmission buffer.

In Step S242, the active C-AGW 5 a transmits contents of thetransmission buffer to the standby U-AGW 6 c.

Thus, the active C-AGW 5 a transmits an activate request containing anidentifier and packet transfer information of a faulty active U-AGW 6 tothe standby U-AGW 6 c.

Next, redundant control of the U-AGW 6 by the standby U-AGW 6 c carriedout in F6 of FIG. 12 is described.

FIG. 14 is a flowchart illustrating an example of redundant control ofthe U-AGW 6 executed by the standby U-AGW 6 c. This processing isexecuted when an activate request is received from the active C-AGW 5 a,which is executed mainly by the redundant control program 67.

In Step S250, the standby U-AGW 6 c obtains an IP address contained inan activate request from the active C-AGW 5 a.

In Step S251, the standby U-AGW 6 c sets session information 71contained in a message received from the active C-AGW 5 a as packettransfer information in the RAM 62.

In Step S252, the standby U-AGW 6 c activates the packet transferprogram 65 to become active.

In Step S253, the standby U-AGW 6 c returns an active response to theactive C-AGW 5 a.

In Step S254, the standby U-AGW 6 c sets an IP address contained in theactivate request therein. Then, the standby U-AGW 6 c transmits agratuitous ARP to the router 400 to change a transfer destinationrecognized by the router 400 for the taken-over IP address to thestandby U-AGW 6 c.

The standby U-AGW 6 c activates transfer processing of user data by theactivated packet transfer program 65.

Thus, the standby U-AGW 6 c receives an activate request from the activeC-AGW 5 a to take over processing of the faulty active U-AGW 6.

As described above, according to the first embodiment of this invention,1:1 redundancy is set in the control plane, and N+1 redundancy is set inthe user plane. In the control plane, copies 71 a-1 to 71 a-N of piecesof information 71-1 to 71-N of user planes of N apparatuses are stored.In the control plane, for the active session information 71, copies 71a-1 to 71 a-N of the standby system are updated to latest information inthe predetermined update cycle. In the control plane, mirroring piecesof session information of all the user planes enables the standbycontrol plane to take over processing within a short time period from afault occurrence of the active system based on the copied sessioninformation 71 a, and enables use for a network for providing voiceservices. In the control plane, no user data is transferred. Thus, evenif the number of sessions increases, the control signal may be processedwithout any influence on throughput of packet transfer.

In the user plane, N+1 redundancy processing is carried out, and copyingof packet transfer information is carried out in the control plane.Thus, user data throughput may be secured by concentrating on transferof the user data. When the number of sessions increases, increasing thenumber of active apparatuses of the user plane enables dealing with theincrease.

The standby U-AGW 6 c of the user plane does not have to carry outprocessing during normal time. Thus, the standby U-AGW 6 c may be in acold standby status. In this case, power consumption of the standbyU-AGW 6 c may be reduced.

The example of using the WatchDog processing for monitoring the activecontrol plane or the active user plane has been described. However, awell-known or known fault monitoring method may be used. For example, anoccurrence of a fault may be judged by detecting a heartbeat of theactive system.

Second Embodiment

FIG. 15 is a sequence diagram illustrating a second embodiment of thisinvention. According to the second embodiment, when processing is takenover from an active U-AGW 6 to a standby U-AGW 6 c, active sessioninformation 711 is copied in packet transfer information 66 to recovertransferring of user data, and then idle session information 712 iscopied to the packet transfer information 66. Other components aresimilar to those of the first embodiment.

FIG. 15 is a sequence diagram illustrating an example of redundantcontrol processing when a fault occurs during an operation of the activeU-AGW 6 a. In FIG. 15, an ordinate indicates time, and an abscissaindicates the apparatuses including the base station 7 or the home agent3, the router 400, the active C-AGW 5 a, the active U-AGW 6 a, and thestandby U-AGW 6 c. Though not shown, processing below is executedbetween the active C-AGW 5 a and the active U-AGW 6 b.

As in the case illustrated in FIG. 12, in Step S30, the active U-AGW 6 atransfers user data (user packet) with the base station 7 or the homeagent 3 via the router 400. In Step S31, the active C-AGW 5 a processesa control signal from the base station 7 or the home agent 3 via therouter 400 as described above.

As in the case illustrated in FIG. 12, in Step S32, the active C-AGW 5 acarries out WatchDog processing (F3) by a U-AGW monitor processingprogram 75 to monitor the active U-AGW 6.

In Step S33, the active C-AGW 5 a detects an occurrence of a fault inthe U-AGW 6 a as a result of the WatchDog processing for the activeU-AGW 6 a.

The active C-AGW 5 a activates redundant control processing of the U-AGW6 (F7). In this redundant control processing, the active C-AGW 5 aobtains the identifier and the IP address of the faulty active U-AGW 6a, and selects active session information 711 for the identifier.

In Step S34, the active C-AGW 5 a transmits an activate requestcontaining the obtained identifier and IP address of the U-AGW 6 a andthe selected active session information 711 to the standby U-AGW 6 c.This processing of transmitting the activate request becomes firstredundant control processing.

In the first embodiment, all the pieces of session information 71 wherethe idle session information 712 is added to the active sessioninformation 711 are transmitted. However, in the second embodiment, onlyactive session information 711 of the session information 71 istransmitted. This is because a session status of a wireless network isfocused described above referring to FIG. 2, and since the activesession information 711 is session information indicating that a mobilestation 8 is in an active status (ongoing communication or communicationpermitted status), immediate call saving is extremely important. On theother hand, since the idle session information 712 is sessioninformation indicating that the mobile station 8 is in an idle status(power-saving mode or noncommunication status), take-over priority maybe reduced.

The standby U-AGW 6 c that has received the activate request activatesredundant control processing of the U-AGW 6 (F6). First, active sessioninformation 711 is extracted from a message of the received activaterequest to be set in packet transfer information 66.

In Step S35, the standby U-AGW 6 c returns an active response to thereceived activate request to the active C-AGW 5 a. The standby U-AGW 6 csets therein an IP address (IP address of a faulty active U-AGW 6 a)contained in the activate request. In Step S36, the standby U-AGW 6 ctransmits gratuitous ARP to a router 400 to change a transferdestination of the taken-over IP address recognized by the router 400 tothe standby U-AGW 6 c. In Step S37, the standby U-AGW 6 c activates apacket transfer program 65 to activate transfer processing of user data.In step 38, a control signal from a home agent 3 or a base station 7 istransmitted to the active C-AGW 5 a via the router 400 to performpredetermined control signal processing.

In other words, the standby U-AGW 6 c copies the active sessioninformation 711 to the packet transfer information 66 to transfer userdata requested to be transferred by the base station 7, the mobilestation 8, or the home agent 3. Thus, the standby U-AGW 6 c that hastaken over processing of the active U-AGW 6 a enables transfer of userdata in an extremely short-time.

Then, to transmit idle session information 712 yet to be transferred,the active C-AGW 5 a executes session generation request processing (F8)for setting idle session information 712 in a message of a sessioncreate request to transmit the message. This session create requestprocessing (F8) becomes second redundant control processing. In StepS39, the active G-AGW 5 a transmits a created session create request tothe standby U-AGW 6 c that has activated to operate by taking over theprocessing of the active system.

A redundant control program 67 of the standby U-AGW 6 c that hasreceived the session generation request executes session createprocessing (F9) for extracting the idle session information 712contained in the message of the session generation request to copy theinformation to packet transfer information 66. Thus, the standby U-AGW 6c resumes transferring of user data based on the active sessioninformation 711, and then copies the idle session information 712 to thepacket transfer information 66, to thereby copy all the sessioninformation 71 of the active system that has processing taken over, tothe packet transfer information 66.

In Step S40, the standby U-AGW 6 c returns a session generation responseindicating completion of the session generation request to the activeC-AGW 5 a.

As described above, the session information 71 is separated intoinformation (active session information 711 and idle session information712) to be set in a user plane and information (U-AGW_ID 101 to thenumber of idle sessions 105 in FIG. 5 a) for managing the user plane,and the information to be set in the user plane is further separatedinto the active session information 711 and the idle session information712. When the user plane of the standby system takes over that of theactive system, in first redundant control processing, in the user planeof the standby system, the active session information 711 is copied tothe packet transfer information 66. Thus, transferring of user dataneeded by the mobile station 8 and the home agent 3 may be quicklyrecovered. Then, after resumption of transferring of the user data inthe user plane of the standby system, in second redundant controlprocessing, the idle session information 712 is copied to the packettransfer information 66 of the user plane of the standby system. As aresult, user data for all the sessions may be transferred.

Next, the processes F7 to F9 of FIG. 15 are described in detail.WatchDog processing (F3) and redundant control (F6) of the standby U-AGW6 c of FIG. 15 are similar to those of the first embodiment, and thusdescription thereof is omitted.

FIG. 16 is a flowchart illustrating an example of the above-mentionedfirst redundant control (F7) (illustrated in FIG. 15) of the U-AGW 6executed by the U-AGW monitor processing program 75 of the active C-AGW5 a. This processing is carried out, as is illustrated in FIG. 10, whenthe U-AGW monitor processing program 75 has detected a fault of theactive U-AGW 6 in WatchDog processing.

In Step S260, the active C-AGW 5 a sets a transmission buffer in the RAM52 so as to transmit a message of an activate request for activating thestandby U-AGW 6 c.

In Step S261, the active C-AGW 5 a obtains the identifier and the IPaddress of the faulty active U-AGW 6, and session information 71corresponding to the identifier.

In Step S262, the identifier and the IP address of the faulty U-AGW 6are set in the transmission buffer.

In Step S263, the active C-AGW 5 a obtain active session information 711specified by an active session information pointer 106 of the sessioninformation 71. In Step S264, the active C-AGW 5 a copies, of the activesession information 711, packet transfer information has been preset tothe transmission buffer.

In Step S265, the active C-AGW 5 a transmits contents of thetransmission buffer to the standby U-AGW 6 c, as an activate request.

Thus, in the first redundant control processing, the active C-AGW 5 atransmits an activate request containing the identifier and the IPaddress of a faulty active U-AGW 6 and active session information 711,to the standby U-AGW 6 c. The standby U-AGW 6 c takes over transferringof user data based only on the active session information 711 indicatingsession information of ongoing communication.

FIG. 17 is a flowchart illustrating an example of second redundantcontrol processing (session generation request processing: F8) of theU-AGW 6 executed by the U-AGW monitor processing program 75 of theactive C-AGW 5 a. As illustrated in FIG. 15, this processing is executedafter a lapse of predetermined time from completion of the firstredundant control processing of FIG. 16. Alternatively, the processingmay be executed when an active response is received from the standbyU-AGW 6 c. In Step S270, the active C-AGW 5 a sets a transmission bufferin the RAM 52 to transmit a message of a session create request forcopying remaining idle session information 712 to the standby U-AGW 6 c.

In Step S271, the active C-AGW 5 a obtains the identifier and the IPaddress of the faulty active U-AGW 6, and session information 71corresponding to the identifier.

In Step S272, the identifier and the IP address of the faulty U-AGW 6are set in the transmission buffer.

In Step S273, the active C-AGW 5 a obtains idle session information 712specified by an idle session information pointer 107 of the sessioninformation 71. The active C-AGW 5 a copies, of the idle sessioninformation 711, predetermined packet transfer information to thetransmission buffer.

In Step S274, the active C-AGW 5 a transmits contents of thetransmission buffer to the standby U-AGW 6 c as a session createrequest.

Thus, in the first redundant control processing, the active C-AGW 5 atransmits an activate request containing an identifier and an IP addressof a faulty active U-AGW 6 and active session information 711 to thestandby U-AGW 6 c.

FIG. 18 is a flowchart illustrating an example of processing executedwhen the redundant control program 67 of the standby U-AGW 6 c hasreceived a session create request from the active C-AGW 5 a.

In Step S375, the standby U-AGW 6 c extracts idle session information712 from the received session create request to add the request topacket transfer information 66. The standby U-AGW 6 c finishesprocessing of the idle session information 71.

In the second redundant control processing, the standby U-AGW 6 c addsthe idle session information 712 to the packet transfer information 66after the activate of transferring of the user data, thereby copying allthe pieces of session information 71 of the faulty user plane to thestandby C-AGW 6 c.

Thus, in the standby user plane, after the activation of the packettransfer program 65, only the active session information 711 is copiedto the packet transfer information 66 to activate transferring of theuser data. Time for copying the idle session information 712 to thepacket transfer information is accordingly made unnecessary, to therebyshorten downtime of the user plane. After the standby user plane takesover processing of the active system to activate its operation, for asession in an idle status (idle session information 712), the activecontrol plane issues a session create request to supplement the packettransfer information 66 of the standby user plane, thereby restoring allthe pieces of session information 71 in the standby user plane to securereliability.

Third Embodiment

FIG. 19 is a block diagram illustrating a relationship of functionelements between a control plane and a user plane according to a thirdembodiment. In FIG. 19, a packet transfer program 77 for transferringuser data is operable in the active C-AGW 5 a of the first embodiment,and other components are similar to those of the first embodiment.

In the active C-AGW 5 a, the packet transfer program 77 similar to thepacket transfer program 65 of the U-AGW 6 is stored in a ROM 50. When afault occurs in the active U-AGW 6, the active C-AGW 5 a activates thepacket transfer program 77 by a U-AGW monitor processing program 75. Thepacket transfer program 77 of the active C-AGW 5 a executes, in place ofthe faulty active U-AGW 6, transferring of user data until redundantcontrol processing is completed.

After the processing is taken over from the active U-AGW 6 by thestandby U-AGW 6 c, the U-AGW 6 monitor processing program 75 controlsthe packet transfer program 65 of the standby U-AGW 6 c to take overprocessing of the packet transfer program 77 operating in the activeC-AGW 5 a, and then finishes the packet transfer program 77.

The flow of the processing is described below with reference to FIG. 20.FIG. 20 is a sequence diagram illustrating an example of redundantcontrol processing when a fault occurs during an operation of the activeU-AGW 6 a. In FIG. 20, an ordinate indicates time, and an abscissaindicates the apparatuses including the base station 7 or the home agent3, the router 400, the active C-AGW 5 a, the active U-AGW 6 a, and thestandby U-AGW 6 c. Though not shown, processing below is executedbetween the active C-AGW 5 a and the active U-AGW 6 b.

In FIG. 20, Steps S50 to S52 are similar to Steps S20 to S23, in whichthe active U-AGW 6 transfers user data with a base station 7 or a homeagent 3, and the active C-AGW 5 a executes processing of a controlsignal. The active C-AGW 5 a carries out WatchDog processing in thepredetermined monitoring cycle. In an example of FIG. 20, the activeC-AGW 5 a detects an occurrence of a fault in the active U-AGW 6 a toactivate redundant control processing (F10) of the U-AGW 6.

The active C-AGW 5 a activates the packet transfer program 77 to beactive, and obtains the identifier and the IP address of the faultyactive U-AGW 6 a and session information 71 corresponding to theidentifier. In Step S54, the active C-AGW 5 a allocates thereto theobtained IP address, and transmits gratuitous ARP for the IP address ofthe faulty active U-AGW 6 a to a router 400 to change a transferdestination of user data recognized by the router 400 to the C-AGW 5 a.Then, in Step S55, the active C-AGW 5 a executes transferring of theuser data based on the packet transfer program 77 and the sessionidentifier 71 corresponding to the identifier, in place of the activeU-AGW 6 a.

The active C-AGW 5 a obtains all pieces of session information 71(active session information 711 and idle session information 712)corresponding to the identifier of the faulty active U-AGW 6 a. In StepS56, the active C-AGW 5 a transmits an activate request containing theidentifier and the IP address of the U-AGW 6 a and all the pieces ofsession information 71 that have been obtained, to the standby U-AGW 6c.

The standby U-AGW 6 c that has received the activate request activatesredundant control processing of the U-AGW 6 (F6). The standby U-AGW 6 cobtains the identifier and the IP address contained in the activaterequest to set them therein. The standby U-AGW 6 c obtains all thepieces of session information contained in the activate request to setthem in the packet transfer information 66.

In Step S57, the standby U-AGW 6 c returns an active response to thereceived activate request, to the active C-AGW 5 a. In Step S58,simultaneously with this processing, the standby U-AGW 6 c sets an IPaddress (IP address of the faulty active U-AGW 6 a) contained in theactivate request therein, and then transmits gratuitous ARP to a router400 to change a transfer destination of the taken-over IP addressrecognized by the router 400 to the standby U-AGW 6 c.

The active C-AGW 5 a that has received the active response releasesallocation for the IP address of the faulty active U-AGW 6 a to finishthe packet transfer program 77.

In Step S59, the standby U-AGW 6 c activates a packet transfer program65 to activate transfer processing of user data. In Step S60, the activeC-AGW 5 a dedicatedly performs processing of a control signal sincealternate user data transfer has been finished.

As described above, the active C-AGW 5 a monitors the active U-AGW 6,and when an occurrence of a fault is detected in any one of the activeU-AGW6, the active C-AGW 5 a transfers user data of the faulty U-AGW 6on its behalf. The active C-AGW 5 a controls the standby U-AGW 6 c totake over processing of the faulty U-AGW 6 a while the active C-AGW 5 ais transferring the user data on its behalf. After the standby U-AGW 6 chas taken over the processing of the faulty U-AGW 6 a, the active C-AGW5 a finishes the packet transfer program 77 to perform normal controlsignal processing.

Next, the processing F10 illustrated in FIG. 20 is described in detail.The WatchDog processing (F3) and the redundant control (F6) of thestandby U-AGW 6 c of FIG. 20 are similar to those of the firstembodiment, and thus description thereof is omitted.

FIG. 21 is a flowchart illustrating an example of redundant controlprocessing (F10) of the U-AGW 6 executed by the U-AGW monitor processingprogram 75 of the active C-AGW 5 a illustrated in FIG. 20. Asillustrated in FIG. 10, this processing is carried out when the U-AGWmonitor processing program 75 has detected a fault of the active U-AGW 6during WatchDog Processing.

In Step S280, the identifier and the IP address of the faulty activeU-AGW 6 a are obtained, and session information 71 corresponding to theidentifier is obtained. The IP address of the faulty U-AGW 6 a isadditionally allocated to the active C-AGW 5 a.

In Step 281, the active C-AGW 5 a activates the packet transfer program77 to be active.

In Step S282, the active C-AGW 5 a allocates the obtained IP addressthereto, and transmits gratuitous ARP to the router 400 for the IPaddress of the faulty active U-AGW 6 a (S54). The active C-AGW 5 aexecutes transferring of user data based on the packet transfer program77 and session information 71 corresponding to the identifier, in placeof the active U-AGW 6 a (S55).

In Step S283, the active U-AGW 5 a executes the redundant controlprocessing illustrated in FIG. 12 of the first embodiment, and createsan activate request to transmit the request to the standby U-AGW 6 c.

In Step S284, the active C-AGW 5 a stands by until it receives an activeresponse from the standby U-AGW 6 c. In Step S285, after reception ofthe active response, the active C-AGW 5 a deactivates (or stops) thepacket transfer program 77 that has been performing transfer of the userdata on behalf of the user plane, to thereby finish the processing.

Thus, since the active system of the control plane transfers the userdata by proxy during when the processing is taken over from the activesystem of the user plane by the standby system, it is possible tofurther shorten downtime in which transferring of the user data stops.Thus, the access gateway apparatus 4 of this invention may be applied toa network that includes voice services such as VoIP in which voicequality has to be guaranteed. Applying this invention to an accessgateway apparatus that processes a large-capacity session enablesexecution of call saving regardless of the amount of session informationto be taken over.

Fourth Embodiment

FIG. 22 illustrates a fourth embodiment, where contents of activesession information 711 of each active system of the user plane of thefirst embodiment is stored in a standby U-AGW 6 c, and other componentsare similar to those of the first embodiment.

FIG. 22 is a block diagram illustrating a relationship of functionelements between the C-AGW 5 and the U-AGW 6. In FIG. 22, the C-AGW 5 issimilar in configuration to that of the first embodiment, and adifference from the first embodiment is that the standby U-AGW 6 cstores pieces of packet transfer information 66-1 to 66-N of activeU-AGWs 6. A packet transfer program 65 of each active U-AGW 6 transmitspacket transfer information 66 to the standby U-AGW 6 c in thepredetermined update cycle, and the standby U-AGW 6 c updates the piecesof packet transfer information 66-1 to 66-N based on the received packettransfer information.

After reception of a notification that a fault has occurred in theactive U-AGW 6 from the active C-AGW 5 a, the standby U-AGW 6 c deletesthose other than packet transfer information 66 of the faulty activeU-AGW 6 among the pieces of packet transfer information 66-1 to 66-N,and activates the packet transfer program 65 to take over transferprocessing of user data.

Redundant control of the active U-AGW 6 carried out in the accessgateway apparatus 4 of FIG. 22 is described below. FIG. 23 is a sequencediagram illustrating an example of redundant control processing when afault occurs during an operation of the active U-AGW 6 a. In FIG. 23, anordinate indicates time, and an abscissa indicates the apparatusesincluding the base station 7 or the home agent 3, the router 400, theactive C-AGW 5 a, the active U-AGW 6 a, and the standby U-AGW 6 c.Though not shown, processing below is executed between the active C-AGW5 a and the active U-AGW 6 b.

In FIG. 23, in Step S70, the active U-AGW 6 a executes mirroringprocessing, issues a mirroring request, to the standby U-AGW 6 c eachtime a predetermined update cycle is reached, and copies active sessioninformation 711 of packet transfer information 66 to the standby U-AGW 6c. The standby U-AGW 6 c receives the mirroring request from the activeU-AGW 6 a, and updates active session information 711 of packet transferinformation 66 for each active U-AGW 6 to store the active sessioninformation 711 (F12).

Steps S71 to S73 are similar to Steps S20 to S23 in FIG. 12 of the firstembodiment described above. The active U-AGW 6 transfers user data witha base station 7 or a home agent 3, and the active C-AGW 5 a executesprocessing of a control signal. The active C-AGW 5 a carries outWatchDog processing in the predetermined monitoring cycle. In an exampleof FIG. 23, the active C-AGW 5 a detects an occurrence of a fault in theactive U-AGW 6 a to activate redundant control processing (F13) of theU-AGW 6.

In this redundant control, the active C-AGW 5 a obtains an identifierand an IP address of the faulty active U-AGW 6 a. In Step S75, theactive C-AGW 5 a transmits an activate request containing the obtainedidentifier and IP address of the U-AGW 6 a to the standby U-AGW 6 c.

The standby U-AGW 6 c that has received the activate request activatesredundant control of the U-AGW 6 (F14). The standby U-AGW 6 c obtainsthe identifier and the IP address contained in the activate request toset them therein. The standby U-AGW 6 c selects one of pieces of packettransfer information 66-1 to 66-N corresponding to the identifiercontained in the activate request, and deletes those other than activesession information 711 of the selected packet transfer information 66.

In Step S76, the standby U-AGW 6 c returns an active response to thereceived activate request, to the active C-AGW 5 a. In Step S77, thestandby U-AGW 6 c sets the IP address (IP address of the faulty activeU-AGW 6 a) contained in the activate request therein, and transmitsgratuitous ARP to an opposite router 400 to change a transferdestination of the taken-over IP address.

In Step S78, the standby U-AGW 6 c activates a packet transfer program65 to activate transfer processing of user data based only on activesession information 711 among pieces of packet transfer information 66-1to 66-N.

In this case, to quickly transfer user data requested to be transferredby a base station 7, a mobile station 8 or a home agent 3, the standbyU-AGW 6 c preferentially copies only active session information 711 inthe packet transfer information 66. Thus, the standby U-AGW 6 c that hastaken over processing of the active U-AGW 6 a may resume transferring ofuser data within an extremely short time.

Then, to transmit idle session information 712 yet to be transferred,the active C-AGW 5 a executes session generation request processing (F8)for setting idle session information 712 in a message of a sessiongeneration request to transmit the message. In Step S79, the activeG-AGW 5 a transmits a created session create request to the standbyU-AGW 6 c that has activated to operate by taking over the processing ofthe active system.

The standby U-AGW 6 c that has received the session create requestexecutes session create processing (F9) for extracting the idle sessioninformation 712 contained in the message of the session generationrequest to copy the idle session information 712 in packet transferinformation 66. Thus, the standby U-AGW 6 c resumes transferring of userdata based on the active session information 711, and then copies theidle session information 712 to the packet transfer information 66, tothereby copy all the session information 71 of the active system thathas processing taken over, to the packet transfer information.

In Step S80, the standby U-AGW 6 c returns a session generation responseindicating completion of the session generation request, to the activeC-AGW 5 a.

As described above, the session information 71 is separated intoinformation (active session information 711 and idle session information712) to be set in a user plane and information (U-AGW_ID 101 to thenumber of idle sessions 105 in FIG. 5 a) for managing the user plane,and the information to be set in the user plane is further separatedinto the active session information 711 and the idle session information712. When the user plane of the standby system takes over that of theactive system, in the user plane of the standby system, the activesession information 711 is copied to the packet transfer information 66.Thus, transferring of user data needed by the mobile station 8 and thehome agent 3 may be quickly recovered. Then, after resumption oftransferring of the user data in the user plane of the standby system,the idle session information 712 is copied to the packet transferinformation 66 of the user plane of the standby system. As a result,user data for all the sessions may be transferred.

Next, each processing illustrated in FIG. 23 is described below indetail. WatchDog processing (F3), processing of setting idle sessioninformation 712 in a message of a session generation request to transmitthe message (F8), and processing of copying a session generation requestin the standby U-AGW 6 c (F9) are similar to those of the first andsecond embodiment, and thus description thereof is omitted.

FIG. 24 is a flowchart illustrating an example of mirroring processing(F11) of the packet transfer information 66 carried out by the packettransfer program 65 of the active U-AGW 6 a illustrated in FIG. 23.

First, in Step S290, whether the mirroring timer of the active U-AGW 6 ahas reached a predetermined update cycle is judged. If the mirroringtimer has not reached the predetermined update cycle, the processproceeds to Step S291.

In Step S291, the active U-AGW 6 a sets a transmission buffer in the RAM62 to transmit a message of a mirroring request for copying only activesession information 711 of the packet transfer information 66 to thestandby U-AGW 6 c.

In Step S292, the active U-AGW 6 a obtains its own identifier to set theidentifier in the transmission buffer. In Step S293, the active U-AGW 6a obtains only the active session information 711 of the packet transferinformation 66, and repeats the processing in Steps S294 to S296 tocreate a message of a mirroring request.

In Step S294, the processing in Steps S294 to S296 is repeated untilthere is no more entry of a transmission target storing the identifierof the MS ID 120 of the packet transfer information 66 illustrated inFIG. 6. If there is still an entry of a transmission target in thepacket transfer information 66, proceeding to Step S295, whether MSstatus 125 is active is judged. If the MS status 125 is active, in StepS296, the entry (or record) is copied to the transmission buffer. If theMS status 125 is idle, returning to Step S294, the process is repeated.

After completion of processing for all the entries in Step S294, in StepS297, contents of the transmission buffer are transmitted as a mirroringrequest to the standby U-AGW 6 c. The active U-AGW 6 a resets themirroring timer to prepare for next transmission.

Thus, the active U-AGW 6 a transmits only the active session information711 of the packet transfer information 66 to the standby U-AGW 6 a ineach predetermined update cycle.

Next, update processing of the pieces of packet transfer information66-1 to 66-N carried out by the standby U-AGW 6 c of FIG. 23 isdescribed.

FIG. 25 is a flowchart illustrating an example of processing where thestandby U-AGW 6 c updates active session information 711 in the piecesof packet transfer information 66-1 to 66-N for each active U-AGW 6(F12). This processing is carried out each time the standby U-AGW 6 creceives a mirroring request from the active U-AGW 6 a.

In Step S300, the standby U-AGW 6 c extracts the identifier of a U-AGW 6from the received mirroring request. In Step S301, the standby U-AGW 6 cjudges whether all the pieces of packet transfer information containedin the message of the received mirroring request have been read. If notall the pieces of packet transfer information have been read, proceedingto Step S302, the standby U-AGW 6 c sets target packet transferinformation in the pieces of packet transfer information 66-1 to 66-Ncorresponding to the identifier of the U-AGW 6. If all the pieces ofpacket transfer information have been read, the processing is finished.

Thus, based on the active session information 711 contained in themessage of the mirroring request, the pieces of packet transferinformation 66-1 to 66-N are updated for each identifier of the U-AGW 6stored by the standby U-AGW 6 c.

Next, activate request transmission processing (F13) that is firstredundant control carried out by the U-AGW monitor processing program 75of the active U-AGW 6 a of FIG. 23 is described.

FIG. 26 is a flowchart illustrating an example of the first redundantcontrol of the U-AGW 6 executed by the U-AGW monitor processing program75 of the active C-AGW 5 a illustrated in FIG. 23. As illustrated inFIG. 10, this processing is executed when the U-AGW monitor processingprogram 75 detects a fault of the active U-AGW 6 during WatchDogprocessing.

In Step S310, the active C-AGW 5 a sets a transmission buffer in the RAM52 so as to transmit a message of an activate request for activating thestandby U-AGW 6 c.

In Step S311, the active C-AGW 5 a obtains the identifier and the IPaddress of the faulty active U-AGW 6.

In Step S312, the identifier and the IP address of the faulty U-AGW 6are set in the transmission buffer.

In Step S313, the active C-AGW 5 a transmits contents of thetransmission buffer as an activate request to the standby U-AGW 6 c.

Thus, in the first redundant control, the active C-AGW 5 a transmits theactivate request containing the identifier and the IP address of thefaulty active U-AGW 6 to the standby U-AGW 6 c. The standby U-AGW 6 ctakes over transferring of user data based only on the active sessioninformation 711 indicating session information of ongoing communicationamong the pieces of packet transfer information 66-1 to 66-N of theU-AGW 6 corresponding to the identifier contained in the activaterequest.

FIG. 27 is a flowchart illustrating an example of the first redundantcontrol (F14) of the U-AGW 6 executed by the redundant control program67 of the standby U-AGW 6 c illustrated in FIG. 23. As illustrated inFIG. 10, this processing is executed when an activate request isreceived from the active C-AGW 5 a.

In Step S320, the standby U-AGW 6 c obtains the IP address of the faultyactive U-AGW 6 contained in the activate request from the active C-AGW 5a.

In Step S321, the standby U-AGW 6 c obtains the identifier of the faultyU-AGW from a message received from the active C-AGW 5 a.

In Step S322, the standby U-AGW 6 c deletes pieces of packet transferinformation 66-1 to 66-N other than that of the faulty active U-AGW 6.The standby U-AGW 6 c may accordingly secure an area of the RAM 62 foruser data transferring.

The standby U-AGW 6 c starts the packet transfer program 65 to beactive.

In Step S324, the standby U-AGW 6 c returns an active response to theactive C-AGW 5 a.

In Step S325, the standby U-AGW 6 c transmits gratuitous ARP to therouter 400 for the IP address contained in the activate request tochange a transfer destination of a user packet, and sets an IP address=Bof the active U-AGW 6 a therein.

The standby U-AGW 6 c activates transfer processing of user data basedon the activated packet transfer program 65.

Thus, the standby U-AGW 6 c receives the activate request from theactive C-AGW 5 a to take over processing of the faulty active C-AGW 6.

According to the fourth embodiment, only the active session information711 of the packet transfer information is copied from the active systemof the user plane to the standby system. When a fault has occurred inthe active U-AGW 6, among the plurality of pieces of packet transferinformation 66-1 to 66-N held by the standby system, packet transferinformation other than that of the faulty active U-AGW 6 is deleted. Inthe user plane of the standby system, only active session information711 of the faulty user plane is left, and transfer processing of theuser data is taken over based only on the active session information711.

Thus, in the standby user plane, after activating of the packet transferprogram 65, transferring of the user data is activated based only on theactive session information 711 that has been obtained beforehand. As aresult, a time corresponding to a period starting from a faultoccurrence to transferring of the active session information 711 to thestandby user plane is made unnecessary, enabling shortening of downtimeof the user plane. After the standby user plane has taken overprocessing of the active system to activate its operation, for a session(idle session information 712) in an idle status, the active controlplane issues a session generation request to supplement the packettransfer information 66 of the standby user plane, whereby all thepieces of session information 71 are restored in the standby user planeto secure reliability.

Each embodiment has been described by way of example where thisinvention is applied to WiMAX and ASN-GW. However, the access gatewayapparatus 4 of this invention may be applied to a network system such asa 3GPP2 UMB system or a 3rd generation partnership project long termevolution (3GPP LTE).

Thus, this invention may be applied to a network system and a gatewayapparatus that transmit/receive a great amount of information at highspeed.

While the present invention has been described in detail and pictoriallyin the accompanying drawings, the present invention is not limited tosuch detail but covers various obvious modifications and equivalentarrangements, which fall within the purview of the appended claims.

What is claimed is:
 1. A communication system comprising: a memory; arouter connected to a first network and a second network; and an accessgateway apparatus connected to the router, configured to transfer databy establishing a communication path between the first network and thesecond network, wherein: the access gateway apparatus comprises: acontrol computer configured to receive control signals from the firstnetwork and the second network to establish a communication path,thereby determining packet transfer information for the data; and atransfer computer configured to receive the packet transfer informationfrom the control computer to transfer the data between the first networkand the second network through the communication path contained in thepacket transfer information; the transfer computer comprises: aplurality of first transfer computers configured to execute the transferof the data; and a second transfer computer configured to take over,when a fault occurs in any one of the plurality of first transfercomputers, processing of the faulty one of the plurality of firsttransfer computers; the control computer comprises: a sessioninformation notification unit configured to notify each of the pluralityof first transfer computers of information containing the determinedcommunication path as session information; a session information storageunit configured to store the session information for each identifier ofthe plurality of first transfer computers; a first fault monitoring unitconfigured to detect an occurrence of a fault in any one of theplurality of first transfer computers; and a first switching controlunit configured to obtain, when the first fault monitoring unit detectsthe occurrence of the fault in any one of the plurality of the firsttransfer computers, an identifier and an address of the faulty one ofthe plurality of first transfer computers, and the session informationset in faulty one of the plurality of the first transfer computers fromthe session information storage unit, and notifying the second transfercomputer of the identifier, the address, and the session informationthat have been obtained; the second transfer computer comprises aredundant control unit configured to set the identifier, the address,and the session information that have been received from the controlcomputer in the second transfer computer to take over the transfer ofthe data; the control computer comprises: a first control computerconfigured to receive the control signals from the first network and thesecond network to establish the communication path, thereby determiningthe packet transfer information for the data; and a second controlcomputer configured to take over, when a fault occurs in the firstcontrol computer, processing of the faulty first control computer; andthe second control computer comprises: a second fault monitoring unitconfigured to detect an occurrence of a fault in the first controlcomputer; a session information copying unit configured to copy thesession information from the first control computer in a predeterminedcycle; and a second switching control unit configured to obtain, whenthe second fault monitoring unit detects the occurrence of the fault inthe first control computer, an identifier and an address of the faultyfirst control computer, setting the identifier and the address that havebeen obtained in the second control computer, and taking over processingof the first control computer based on the session information copied bythe session information copying unit.
 2. The communication systemaccording to claim 1, wherein: the session information storage unitstores, for the session information, session information of ongoingcommunication as active session information for each of the plurality offirst transfer computers, and session information of suspendedcommunication as idle session information for each of the plurality offirst transfer computers; the first switching control unit is configuredto: obtain, when the first fault monitoring unit detects the occurrenceof the fault in the any one of the plurality of first transfercomputers, the identifier, and the address of the faulty one of theplurality of first transfer computers, and the active sessioninformation set in the faulty one of the plurality of first transfercomputers from the session information storage unit, and notify thesecond transfer computer of the identifier, the address, and the activesession information that have been obtained; and notify, after thesecond transfer computer has taken over the transfer of the data, thesecond transfer computer of the idle session information set in thefaulty one of the plurality of first transfer computers; and theredundant control unit sets, after taking-over of the transfer of thedata based on the identifier, the address, and the active sessioninformation that have been received from the control computer, theactive session information received from the control computer in thesecond transfer computer.
 3. The computer system according to claim 1,wherein: the first switching control unit comprises an alternate datatransfer unit configured to execute the transfer of the data by proxy;and the first switching control unit is configured to: set, when thefirst fault monitoring unit detects the occurrence of the fault in theany one of the plurality of first transfer computers, the identifier andthe address of the faulty one of the plurality of first transfercomputers in the control computer; notify, after the session informationset in the faulty one of the plurality of first transfer computers isobtained from the session information storage unit to activate thetransfer of the data by the alternate data transfer unit, the secondtransfer computer of the identifier, the address, and the sessioninformation that have been obtained; and stop the alternate datatransfer unit after the second transfer computer has taken over theprocessing of the first transfer computer.
 4. The communication systemaccording to claim 1, wherein: the plurality of first transfer computersare each configured to: store, for the session information received fromthe control computer, session information of ongoing communication asactive session information, and session information of suspendedcommunication as idle session information; and transmit the activesession information to the second transfer computer at predeterminedcycles; the second transfer computer stores the active sessioninformation received from the plurality of first transfer computers foreach of the plurality of first transfer computers; the first switchingcontrol unit is configured to: obtain, when the first fault monitoringunit detects the occurrence of the fault in the one of the plurality offirst transfer computers, the identifier, and the address of the faultyone of the plurality of first transfer computers, and the idle sessioninformation set in the faulty one of the plurality of first transfercomputers from the session information storage unit; and notify thesecond transfer computer of the identifier and the address that havebeen obtained, and after the second transfer computer has taken over theprocessing of the faulty one of the plurality of first transfercomputers, notify the faulty one of the plurality of first transfercomputers of the idle session information set in the faulty one of theplurality of first transfer computers; and the second transfer computeris configured to: set the identifier and the address that have beenreceived from the first switching control unit in the faulty one of theplurality of first transfer computers; and store, after the activesession information corresponding to the identifier has been obtained totake over the transfer of the data of the faulty one of the plurality offirst transfer computers, the idle session information received from thefirst switching control unit.
 5. A method of controlling an accessgateway apparatus for transferring data by establishing a communicationpath between a first network and a second network, the access gatewayapparatus comprising: a control computer configured to receive controlsignals from the first network and the second network to establish thecommunication path, thereby determining packet transfer information forthe data; and a transfer computer configured to receive the packettransfer information from the control computer to transfer the databetween the first network and the second network through thecommunication path contained in the packet transfer information; thecontrol computer comprising: a first control computer configured toreceive the control signals from the first network and the secondnetwork to establish the communication path, thereby determining packettransfer information for the data; and a second control computerconfigured to take over, when a fault occurs in the first controlcomputer, processing of the faulty first control computer; the transfercomputer comprising: a plurality of first transfer computers configuredto execute the transfer of the data; and a second transfer computerconfigured to take over, when a fault occurs in one of the plurality offirst transfer computers, processing of the faulty one of the pluralityof first transfer computers; the method comprising: notifying, by thecontrol computer, each of the plurality of first transfer computers ofinformation containing the determined communication path as sessioninformation; storing, by the control computer, the session informationfor each identifier of the plurality of first transfer computers in asession information storage unit; detecting, by the control computer, anoccurrence of a fault in any one of the plurality of first transfercomputers; obtaining, by the control computer, when the occurrence ofthe fault in the one of the plurality of first transfer computers isdetected, an identifier and an address of the faulty one of theplurality of first transfer computers, and the session information setin the faulty one of the plurality of first transfer computers from thesession information storage unit, and notifying the second transfercomputer of the identifier, the address, and the session informationthat have been obtained; setting, by the second transfer computer, theidentifier, the address, and the session information that have beenreceived from the control computer in the second transfer computer totake over the transfer of the data; detecting, by the second controlcomputer, the occurrence of the fault in the first control computer;copying the session information from the first control computer to thesecond control computer in a predetermined cycle; and obtaining, by thesecond control computer, when the occurrence of the fault in the firstcontrol computer is detected, an identifier and an address of the faultyfirst control computer, setting the identifier and the address that havebeen obtained in the second control computer, and taking over theprocessing of the first control computer based on the copied sessioninformation.
 6. The method of controlling an access gateway apparatusaccording to claim 5, further comprising: storing, by the sessioninformation storage unit, for the session information, sessioninformation of ongoing communication as active session information foreach of the plurality of first transfer computers, and sessioninformation of suspended communication as idle session information foreach of the plurality of first transfer computers; obtaining, by thecontrol unit, when the occurrence of the fault in the one of theplurality of first transfer computers is detected, the identifier andthe address of the faulty one of the plurality of first transfercomputers, and the active session information set in the one of theplurality of first transfer computers from the session informationstorage unit, and notifying the second transfer computer of theidentifier, the address, and the active session information that havebeen obtained; setting, by the second transfer computer, the identifier,the address, and the active session information that have been receivedfrom the control computer to take over the processing of the transfer ofthe data; notifying, after the second transfer computer has taken overthe transfer of the data, the second transfer computer of the idlesession information set in the faulty one of the plurality of firsttransfer computers; and setting, by the second transfer computer, theactive session information received from the control computer in thesecond transfer computer.
 7. The method of controlling an access gatewayapparatus according to claim 5, further comprising: setting, by thecontrol computer, when the occurrence of the fault in the one of theplurality of first transfer computers is detected, the identifier andthe address of the faulty one of the plurality of first transfercomputers in the control computers, and obtaining the sessioninformation set in the faulty one of the plurality of first transfercomputers from the session information storage unit to activate thetransfer of the data in place of the one of the plurality of firsttransfer computer, notifying, by the control computer, the secondtransfer computer of the identifier, the address, and the sessioninformation that have been obtained; taking over, by the second transfercomputer, the processing of the one of the plurality of first transfercomputers based on the identifier, the address, and the sessioninformation that have been received from the control computer; andstopping, by the control computer, the transfer of the data after thesecond transfer computer has taken over the processing of the one of theplurality of first transfer computers.
 8. The method of controlling anaccess gateway apparatus according to claim 5, further comprising:storing, by each of the plurality of first transfer computers, for thesession information received from the control computer, sessioninformation of ongoing communication as active session information, andsession information of suspended communication as idle sessioninformation, and transmitting the active session information to thesecond transfer computer at predetermined cycles; storing, by the secondtransfer computer, the active session information received from theplurality of first transfer computers for the each of the plurality offirst transfer computers; obtaining, by the control computer, when theoccurrence of the fault in the one of the plurality of first transfercomputers is detected, the identifier and the address of the faulty oneof the plurality of first transfer computers, and notifying the secondtransfer computer of the identifier and the address that have beenobtained; setting, by the second transfer computer, the identifier andthe address that have been received from the control computer in thesecond transfer computer, and obtaining the active session informationcorresponding to the identifier from the stored active sessioninformation to take over the processing of the one of the plurality offirst transfer computers; notifying, by the control computer, after thesecond transfer computer has taken over the processing of the faulty oneof the plurality of first transfer computers, the second transfercomputer of the idle session information set in the one of the pluralityof first transfer computers; and storing, by the second transfercomputer, the idle session information received from the controlcomputer.
 9. An access gateway apparatus for transferring data byestablishing a communication path between a first network and a secondnetwork, comprising: a memory; a control computer configured to receivecontrol signals from the first network and the second network toestablish the communication path, thereby determining packet transferinformation for the data; and a transfer computer configured to receivethe packet transfer information from the control computer to transferthe data between the first network and the second network through thecommunication path contained in the packet transfer information,wherein: the transfer computer comprises: a plurality of first transfercomputers configured to execute the transfer of the data; and a secondtransfer computer configured to take over, when a fault occurs in anyone of the plurality of first transfer computers, processing of thefaulty one of the plurality of first transfer computers; the controlcomputer comprises: a session information notification unit configuredto notify each of the plurality of first transfer computers ofinformation containing the determined communication path as sessioninformation; a session information storage unit configured to store thesession information for each identifier of the plurality of firsttransfer computers; a first fault monitoring unit configured to detectan occurrence of a fault in any one of the plurality of first transfercomputers; and a first switching control unit configured to obtain, whenthe first fault monitoring unit detects the occurrence of the fault inthe one of the plurality of first transfer computers, an identifier, andan address of the faulty one of the plurality of first transfercomputers, and the session information set in the one of the pluralityof first transfer computers from the session information storage unit,and to notify the second transfer computer of the identifier, theaddress, and the session information that have been obtained; the secondtransfer computer comprises a redundant control unit configured to setthe identifier, the address, and the session information that have beenreceived from the control computer in the second transfer computer totake over the transfer of the data; the control computer comprises: afirst control computer configured to receive the control signals fromthe first network and the second network to establish the communicationpath, thereby determining the packet transfer information for the data;and a second control computer configured to take over, when a faultoccurs in the first control computer, processing of the faulty firstcontrol computer; and the second control computer comprises: a secondfault monitoring unit configured to detect an occurrence of a fault inthe first control computer; a session information copying unitconfigured to copy the session information from the first controlcomputer in a predetermined cycle; and a second switching control unitconfigured to obtain, when the second fault monitoring unit detects theoccurrence of the fault in the first control computer, an identifier andan address of the faulty first control computer, setting the identifierand the address that have been obtained in the second control computer,and to take over the processing of the first control computer based onthe session information copied by the session information copying unit.